@broberg/sso 0.13.0 → 0.14.2

package/dist/hono.cjs

@@ -1,786 +1,8 @@
 'use strict';
 
+var chunkJGIO7XPR_cjs = require('./chunk-JGIO7XPR.cjs');
 var hono = require('hono');
-var jose = require('jose');
 
-// src/hono.ts
-
-// src/config.ts
-var SsoConfigError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "SsoConfigError";
-  }
-};
-function required(env, name, hint) {
-  const raw = env[name];
-  if (typeof raw !== "string" || raw.trim() === "") {
-    throw new SsoConfigError(`${name} is not set (or is blank). ${hint}`);
-  }
-  return raw.trim();
-}
-var DEFAULT_SESSION_MAX_AGE = 60 * 60 * 24 * 7;
-function loadSsoConfig(env = process.env) {
-  const rawIssuer = required(
-    env,
-    "BID_ISSUER",
-    "It is Broberg ID's bare origin, e.g. https://id.broberg.ai"
-  );
-  let issuer;
-  try {
-    const url = new URL(rawIssuer);
-    if (url.protocol !== "https:" && url.hostname !== "localhost") {
-      throw new SsoConfigError(
-        `BID_ISSUER must be https (got ${url.protocol}//). Only localhost may be http.`
-      );
-    }
-    issuer = url.origin;
-  } catch (err) {
-    if (err instanceof SsoConfigError) throw err;
-    throw new SsoConfigError(`BID_ISSUER is not a valid URL: ${rawIssuer}`);
-  }
-  const cookieSecret = required(
-    env,
-    "SSO_COOKIE_SECRET",
-    "Generate one with `openssl rand -hex 32`. It signs this app's session cookie."
-  );
-  if (cookieSecret.length < 32) {
-    throw new SsoConfigError(
-      `SSO_COOKIE_SECRET is ${cookieSecret.length} characters; it must be at least 32. A short secret is a forgeable session, and a forged session is any user you like.`
-    );
-  }
-  const rawMaxAge = env.SSO_SESSION_MAX_AGE?.trim();
-  let sessionMaxAge = DEFAULT_SESSION_MAX_AGE;
-  if (rawMaxAge) {
-    const n = Number(rawMaxAge);
-    if (!Number.isFinite(n) || n <= 0) {
-      throw new SsoConfigError(
-        `SSO_SESSION_MAX_AGE must be a positive number of seconds (got ${JSON.stringify(rawMaxAge)}).`
-      );
-    }
-    sessionMaxAge = Math.floor(n);
-  }
-  return {
-    issuer,
-    clientId: required(env, "SSO_CLIENT_ID", "The id this app is registered under in Broberg ID."),
-    redirectUri: required(
-      env,
-      "SSO_REDIRECT_URI",
-      "Must match the registered redirect EXACTLY \u2014 one trailing slash is a different address."
-    ),
-    scopes: (env.SSO_SCOPES?.trim() || "openid profile email").split(/\s+/),
-    cookieSecret,
-    cookieName: env.SSO_COOKIE_NAME?.trim() || "bid_session",
-    sessionMaxAge,
-    postLogoutRedirectUri: env.SSO_POST_LOGOUT_REDIRECT_URI?.trim() || void 0,
-    clientSecret: env.SSO_CLIENT_SECRET?.trim() || void 0
-  };
-}
-var JwksError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "JwksError";
-  }
-};
-var JwksUnavailableError = class extends JwksError {
-  constructor(message) {
-    super(message);
-    this.name = "JwksUnavailableError";
-  }
-};
-var JwksUnknownKeyError = class extends JwksError {
-  constructor(message) {
-    super(message);
-    this.name = "JwksUnknownKeyError";
-  }
-};
-function createJwksCache(options) {
-  const {
-    jwksUri,
-    minRefetchIntervalMs = 1e4,
-    warmUp = false,
-    fetchImpl = fetch,
-    now = () => Date.now()
-  } = options;
-  let keys = [];
-  let lastFetchAt = -Infinity;
-  let fetchCount = 0;
-  let inFlight = null;
-  async function refresh() {
-    if (inFlight) return inFlight;
-    inFlight = (async () => {
-      let res;
-      try {
-        res = await fetchImpl(jwksUri);
-      } catch (cause) {
-        throw new JwksUnavailableError(
-          `${jwksUri} could not be reached: ${cause instanceof Error ? cause.message : String(cause)}`
-        );
-      }
-      if (!res.ok) {
-        throw new JwksUnavailableError(
-          `${jwksUri} answered ${res.status} \u2014 cannot verify any token right now`
-        );
-      }
-      let body;
-      try {
-        body = await res.json();
-      } catch {
-        throw new JwksUnavailableError(`${jwksUri} answered 200 with a body that is not JSON`);
-      }
-      if (!Array.isArray(body?.keys)) {
-        throw new JwksUnavailableError(`${jwksUri} returned no "keys" array`);
-      }
-      keys = body.keys;
-      lastFetchAt = now();
-      fetchCount++;
-    })().finally(() => {
-      inFlight = null;
-    });
-    return inFlight;
-  }
-  if (warmUp) {
-    void refresh().catch(() => {
-    });
-  }
-  return {
-    get fetchCount() {
-      return fetchCount;
-    },
-    async getKey(kid, alg) {
-      let jwk = keys.find((k) => k.kid === kid);
-      if (!jwk) {
-        const sinceLast = now() - lastFetchAt;
-        if (sinceLast < minRefetchIntervalMs) {
-          throw new JwksUnavailableError(
-            `kid ${kid} is not in the key set we hold, fetched ${sinceLast}ms ago (we do not ask the issuer again within ${minRefetchIntervalMs}ms). A key set this fresh that lacks the kid means the token was not signed by this issuer \u2014 reject it. Only a key rotation within the last ${minRefetchIntervalMs}ms could make that wrong.`
-          );
-        }
-        await refresh();
-        jwk = keys.find((k) => k.kid === kid);
-      }
-      if (!jwk) {
-        throw new JwksUnknownKeyError(
-          `Broberg ID does not publish a signing key with kid ${kid}. The token was not signed by this issuer.`
-        );
-      }
-      return jose.importJWK(jwk, alg);
-    }
-  };
-}
-
-// src/client.ts
-var SsoError = class extends Error {
-  constructor(message) {
-    super(message);
-    this.name = "SsoError";
-  }
-};
-var SsoReauthError = class extends SsoError {
-  constructor(message, reason) {
-    super(message);
-    this.reason = reason;
-    this.name = "SsoReauthError";
-  }
-  reason;
-};
-var SsoAppApiError = class extends SsoError {
-  constructor(message, status, code) {
-    super(message);
-    this.status = status;
-    this.code = code;
-    this.name = "SsoAppApiError";
-  }
-  status;
-  code;
-};
-var SsoInsufficientScopeError = class extends SsoAppApiError {
-  constructor(message, scope) {
-    super(message, 403, "insufficient_scope");
-    this.scope = scope;
-    this.name = "SsoInsufficientScopeError";
-  }
-  scope;
-};
-var SsoAvatarRejectedError = class extends SsoError {
-  constructor(message, reason) {
-    super(message);
-    this.reason = reason;
-    this.name = "SsoAvatarRejectedError";
-  }
-  reason;
-};
-var MAX_AVATAR_BYTES = 2 * 1024 * 1024;
-var AVATAR_TYPES = ["image/png", "image/jpeg", "image/webp"];
-function mediaType(contentType) {
-  return (contentType ?? "").split(";")[0].trim().toLowerCase();
-}
-var b64url = (bytes) => {
-  const view = bytes instanceof Uint8Array ? bytes : new Uint8Array(bytes);
-  let s = "";
-  for (const b of view) s += String.fromCharCode(b);
-  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-};
-var randomToken = (bytes = 32) => b64url(crypto.getRandomValues(new Uint8Array(bytes)));
-async function challengeFor(verifier) {
-  return b64url(await crypto.subtle.digest("SHA-256", new TextEncoder().encode(verifier)));
-}
-var ADDRESS_OWNERSHIP = /* @__PURE__ */ new Set(["verified", "unverified", "not_on_account"]);
-var INVITATION_OUTCOMES = /* @__PURE__ */ new Set([
-  "invited",
-  "already_invited",
-  "existing",
-  "invalid",
-  "too_soon",
-  "too_many_today",
-  "send_failed"
-]);
-var MIGRATION_STATES = /* @__PURE__ */ new Set(["ready", "invited", "expired", "not_invited"]);
-var BACKCHANNEL_EVENT = "http://schemas.openid.net/event/backchannel-logout";
-var MAX_INVITATIONS = 500;
-function excerptForLog(raw, clientSecret) {
-  let text = raw.replace(/\s+/g, " ").trim();
-  if (clientSecret) text = text.split(clientSecret).join("[redacted client_secret]");
-  if (text === "") return "(empty body)";
-  return text.length > 200 ? `${text.slice(0, 200)}\u2026` : text;
-}
-function invalidClientHint(error, weSentASecret) {
-  if (error !== "invalid_client") return "";
-  return weSentASecret ? " \u2014 we DID send a client_secret, so either it is wrong or this client is registered as PUBLIC (in which case unset SSO_CLIENT_SECRET)." : " \u2014 we sent NO client_secret, so this client is likely registered as CONFIDENTIAL (set SSO_CLIENT_SECRET to the value it was registered with).";
-}
-var ALLOWED_ALGS = [
-  // FIRST, because it is what Broberg ID actually signs with. Measured on the
-  // live issuer 2026-09-20:
-  //   /jwks      kid=Iodh… kty=OKP alg=EdDSA crv=Ed25519
-  //   discovery  id_token_signing_alg_values_supported: ["EdDSA"]
-  //
-  // 0.2.1 SHIPPED THIS LIST WITHOUT IT and rejected every real token for an
-  // hour. The list was written from what an OIDC client usually allows rather
-  // than from what our issuer uses — and the whole suite missed it because the
-  // fake issuer in the tests signs RS256. A fake agrees with whoever wrote it.
-  // There is now a test that mints EdDSA, the algorithm production uses.
-  "EdDSA",
-  "RS256",
-  "RS384",
-  "RS512",
-  "PS256",
-  "PS384",
-  "PS512",
-  "ES256",
-  "ES384",
-  "ES512"
-];
-function createSsoClient(config, options = {}) {
-  const fetchImpl = options.fetchImpl ?? fetch;
-  const timeoutMs = options.timeoutMs ?? 1e4;
-  async function appPost(path, bearer, payload, what) {
-    const url = new URL(path, config.issuer).toString();
-    const ctrl = new AbortController();
-    let timer;
-    const timedOut = new Promise((_, reject) => {
-      timer = setTimeout(() => {
-        ctrl.abort();
-        reject(new SsoError(`${url} did not answer within ${timeoutMs} ms \u2014 ${what} is unknown.`));
-      }, timeoutMs);
-    });
-    try {
-      const res = await Promise.race([
-        fetchImpl(url, {
-          method: "POST",
-          headers: { authorization: `Bearer ${bearer}`, "content-type": "application/json" },
-          body: JSON.stringify(payload),
-          signal: ctrl.signal
-        }),
-        timedOut
-      ]);
-      if (!res.ok) {
-        const detail = await res.text().catch(() => "");
-        const hint = detail.includes("invalid_app_key") ? " (invalid_app_key: this app's bidk_ key was refused)" : "";
-        throw new SsoError(`${url} answered ${res.status}${hint} \u2014 ${what} is unknown.`);
-      }
-      return await Promise.race([res.json().catch(() => null), timedOut]);
-    } catch (e) {
-      if (e instanceof SsoError) throw e;
-      throw new SsoError(`${url} could not be reached: ${e instanceof Error ? e.message : String(e)} \u2014 ${what} is unknown.`);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  async function appRequest(path, bearer, init, what) {
-    const url = new URL(path, config.issuer).toString();
-    const ctrl = new AbortController();
-    let timer;
-    const timedOut = new Promise((_, reject) => {
-      timer = setTimeout(() => {
-        reject(new SsoAppApiError(`${url} did not answer within ${timeoutMs} ms \u2014 ${what} is unknown.`, null, void 0));
-        ctrl.abort();
-      }, timeoutMs);
-    });
-    const headers = { authorization: `Bearer ${bearer}` };
-    let body;
-    if (init.json !== void 0) {
-      headers["content-type"] = "application/json";
-      body = JSON.stringify(init.json);
-    } else if (init.bytes !== void 0) {
-      headers["content-type"] = init.contentType ?? "application/octet-stream";
-      body = init.bytes;
-    }
-    try {
-      const res = await Promise.race([
-        fetchImpl(url, { method: init.method, headers, ...body !== void 0 ? { body } : {}, signal: ctrl.signal }),
-        timedOut
-      ]);
-      const raw = await Promise.race([res.text(), timedOut]);
-      let parsed;
-      try {
-        parsed = raw.trim() === "" ? void 0 : JSON.parse(raw);
-      } catch {
-        parsed = void 0;
-      }
-      const fields = parsed && typeof parsed === "object" ? parsed : {};
-      const code = typeof fields.error === "string" ? fields.error : void 0;
-      if (!res.ok) {
-        if (res.status === 403 && code === "insufficient_scope") {
-          const scope = typeof fields.scope === "string" && fields.scope ? fields.scope : init.method === "GET" ? "profile" : "profile:write";
-          throw new SsoInsufficientScopeError(
-            `${url} answered 403 insufficient_scope \u2014 the user's token lacks scope "${scope}"; log in again with it requested.`,
-            scope
-          );
-        }
-        throw new SsoAppApiError(`${url} answered ${res.status}${code ? ` (${code})` : ""} \u2014 ${what} is unknown.`, res.status, code);
-      }
-      if (parsed === void 0) {
-        throw new SsoAppApiError(`${url} answered ${res.status} with a body that is not JSON \u2014 ${what} is unknown.`, res.status, void 0);
-      }
-      return parsed;
-    } catch (e) {
-      if (e instanceof SsoError) throw e;
-      throw new SsoAppApiError(`${url} could not be reached (${e instanceof Error ? e.name : "error"}) \u2014 ${what} is unknown.`, null, void 0);
-    } finally {
-      clearTimeout(timer);
-    }
-  }
-  function asProfile(body, path) {
-    const b = body ?? {};
-    if (typeof b.sub !== "string" || b.sub === "" || typeof b.account_url !== "string") {
-      throw new SsoAppApiError(`${path} returned no "sub" or "account_url" \u2014 the profile is unknown.`, 200, void 0);
-    }
-    const opt = (v) => typeof v === "string" ? v : null;
-    return { sub: b.sub, name: opt(b.name), picture: opt(b.picture), email: opt(b.email), account_url: b.account_url };
-  }
-  let discoveryPromise = null;
-  let jwksCache = null;
-  async function discovery() {
-    discoveryPromise ??= (async () => {
-      const url = `${config.issuer}/.well-known/openid-configuration`;
-      const res = await fetchImpl(url);
-      if (!res.ok) throw new SsoError(`${url} answered ${res.status}`);
-      const doc = await res.json();
-      const advertised = doc.id_token_signing_alg_values_supported;
-      if (Array.isArray(advertised) && advertised.length > 0) {
-        const usable = advertised.filter((a) => ALLOWED_ALGS.includes(a));
-        if (usable.length === 0) {
-          throw new SsoError(
-            `${config.issuer} signs ID tokens with ${advertised.join(", ")}, and this client accepts none of those (it allows ${ALLOWED_ALGS.join(", ")}). Every token would be rejected. This is a mismatch between the package and the issuer \u2014 report it rather than working around it.`
-          );
-        }
-      }
-      if (doc.issuer !== config.issuer) {
-        throw new SsoError(
-          `BID_ISSUER is ${config.issuer} but ${url} says its issuer is ${doc.issuer}. These must match exactly \u2014 tokens are validated against the issuer string.`
-        );
-      }
-      return doc;
-    })().catch((err) => {
-      discoveryPromise = null;
-      throw err;
-    });
-    return discoveryPromise;
-  }
-  async function keys() {
-    if (!jwksCache) {
-      const { jwks_uri } = await discovery();
-      jwksCache = createJwksCache({
-        jwksUri: jwks_uri,
-        fetchImpl,
-        ...options.minRefetchIntervalMs !== void 0 ? { minRefetchIntervalMs: options.minRefetchIntervalMs } : {}
-      });
-    }
-    return jwksCache;
-  }
-  async function verifyLogoutToken(token) {
-    const cache = await keys();
-    let header;
-    try {
-      header = jose.decodeProtectedHeader(token);
-    } catch {
-      throw new SsoError("logout_token is not a JWS");
-    }
-    if (!header.kid) throw new SsoError("logout_token has no kid \u2014 cannot pick a signing key");
-    let payload;
-    try {
-      ({ payload } = await jose.jwtVerify(token, async () => cache.getKey(header.kid, header.alg ?? "RS256"), {
-        issuer: config.issuer,
-        audience: config.clientId,
-        algorithms: ALLOWED_ALGS,
-        typ: "logout+jwt",
-        requiredClaims: ["iat", "exp", "jti"]
-      }));
-    } catch (e) {
-      throw new SsoError(`logout_token rejected: ${e instanceof Error ? e.message : String(e)}`);
-    }
-    const events = payload.events;
-    if (!events || typeof events !== "object" || !(BACKCHANNEL_EVENT in events)) {
-      throw new SsoError("logout_token has no back-channel logout event");
-    }
-    if ("nonce" in payload) throw new SsoError("logout_token carries a nonce \u2014 that is an ID token, not a logout token");
-    if ("sid" in payload) {
-      throw new SsoError("logout_token carries sid \u2014 only sub-wide \xABLog ud overalt\xBB is accepted (D-376ffa)");
-    }
-    if (typeof payload.sub !== "string" || payload.sub === "") throw new SsoError("logout_token has no sub");
-    return { sub: payload.sub, iat: payload.iat, jti: String(payload.jti), exp: payload.exp };
-  }
-  async function verifyIdToken(idToken, opts = {}) {
-    const cache = await keys();
-    const header = jose.decodeProtectedHeader(idToken);
-    if (!header.kid) throw new SsoError("ID token has no kid \u2014 cannot pick a signing key");
-    const { payload } = await jose.jwtVerify(
-      idToken,
-      async () => cache.getKey(header.kid, header.alg ?? "RS256"),
-      { issuer: config.issuer, audience: config.clientId, algorithms: ALLOWED_ALGS }
-    );
-    if (opts.nonce !== void 0 && payload.nonce !== opts.nonce) {
-      throw new SsoError(
-        "ID token nonce does not match this login request \u2014 refusing a token minted for another sign-in."
-      );
-    }
-    if (typeof payload.sub !== "string" || payload.sub === "") {
-      throw new SsoError("ID token has no sub \u2014 there is no user to be");
-    }
-    return payload;
-  }
-  async function withUserInfo(claims, accessToken) {
-    const doc = await discovery();
-    if (!doc.userinfo_endpoint) return { claims, unverifiedClaims: [] };
-    const res = await fetchImpl(doc.userinfo_endpoint, {
-      headers: { authorization: `Bearer ${accessToken}` }
-    });
-    if (!res.ok) return { claims, unverifiedClaims: [] };
-    const info = await res.json();
-    if (info.sub !== claims.sub) {
-      throw new SsoError(
-        `userinfo describes ${String(info.sub)} but the ID token is for ${claims.sub} \u2014 refusing to merge another user's profile onto this session.`
-      );
-    }
-    const unverifiedClaims = Object.keys(info).filter((k) => k !== "sub" && info[k] !== void 0 && !(k in claims)).sort();
-    return { claims: { ...info, ...claims, sub: claims.sub }, unverifiedClaims };
-  }
-  return {
-    discovery,
-    get jwks() {
-      if (!jwksCache) throw new SsoError("the key cache is created on first verification");
-      return jwksCache;
-    },
-    verifyIdToken,
-    async beginLogin(opts = {}) {
-      const { authorization_endpoint } = await discovery();
-      const codeVerifier = randomToken();
-      const state = randomToken(16);
-      const nonce = randomToken(16);
-      const params = new URLSearchParams({
-        response_type: "code",
-        client_id: config.clientId,
-        redirect_uri: config.redirectUri,
-        scope: [.../* @__PURE__ */ new Set([...config.scopes, ...opts.scopes ?? []])].join(" "),
-        state,
-        nonce,
-        code_challenge: await challengeFor(codeVerifier),
-        code_challenge_method: "S256"
-      });
-      if (opts.prompt) params.set("prompt", opts.prompt);
-      return { url: `${authorization_endpoint}?${params}`, state, codeVerifier, nonce };
-    },
-    async completeLogin({ params, state, codeVerifier, nonce }) {
-      const error = params.get("error");
-      if (error) {
-        throw new SsoError(
-          `Broberg ID refused this login: ${error}` + (params.get("error_description") ? ` \u2014 ${params.get("error_description")}` : "")
-        );
-      }
-      const returned = params.get("state");
-      if (!returned || returned !== state) {
-        throw new SsoError(
-          "state does not match the login this browser started \u2014 refusing the callback."
-        );
-      }
-      const code = params.get("code");
-      if (!code) throw new SsoError("callback carried neither an error nor a code");
-      const { token_endpoint } = await discovery();
-      const res = await fetchImpl(token_endpoint, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          grant_type: "authorization_code",
-          code,
-          redirect_uri: config.redirectUri,
-          client_id: config.clientId,
-          // ALWAYS sent, secret or not. See SsoConfig.clientSecret: the two
-          // prove different things, so a confidential client keeps PKCE.
-          code_verifier: codeVerifier,
-          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
-        })
-      });
-      const raw = await res.text();
-      let body;
-      try {
-        body = raw.trim() === "" ? {} : JSON.parse(raw);
-      } catch {
-        throw new SsoError(
-          `token exchange failed (${res.status}): the response body is not JSON${res.headers.get("content-type") ? ` (content-type: ${res.headers.get("content-type")})` : ""} \u2014 ${excerptForLog(raw, config.clientSecret)}`
-        );
-      }
-      if (!res.ok || !body.id_token) {
-        throw new SsoError(
-          `token exchange failed (${res.status}): ${body.error ?? "no id_token in response"}` + (body.error_description ? ` \u2014 ${body.error_description}` : "") + invalidClientHint(body.error, config.clientSecret !== void 0)
-        );
-      }
-      const claims = await verifyIdToken(body.id_token, { nonce });
-      const merged = body.access_token ? await withUserInfo(claims, body.access_token) : { claims, unverifiedClaims: [] };
-      return {
-        claims: merged.claims,
-        unverifiedClaims: merged.unverifiedClaims,
-        idToken: body.id_token,
-        ...body.access_token ? { accessToken: body.access_token } : {},
-        ...body.refresh_token ? { refreshToken: body.refresh_token } : {},
-        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
-      };
-    },
-    async refreshTokens(refreshToken) {
-      const { token_endpoint } = await discovery();
-      const res = await fetchImpl(token_endpoint, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body: new URLSearchParams({
-          grant_type: "refresh_token",
-          refresh_token: refreshToken,
-          client_id: config.clientId,
-          ...config.clientSecret ? { client_secret: config.clientSecret } : {}
-        })
-      });
-      const raw = await res.text();
-      let body;
-      try {
-        body = raw.trim() === "" ? {} : JSON.parse(raw);
-      } catch {
-        throw new SsoError(`token refresh failed (${res.status}): the response body is not JSON`);
-      }
-      if (!res.ok || typeof body.access_token !== "string" || body.access_token === "") {
-        throw new SsoError(`token refresh failed (${res.status}): ${body.error ?? "no access_token in response"}`);
-      }
-      return {
-        accessToken: body.access_token,
-        ...typeof body.refresh_token === "string" && body.refresh_token ? { refreshToken: body.refresh_token } : {},
-        ...typeof body.expires_in === "number" ? { expiresIn: body.expires_in } : {}
-      };
-    },
-    async logoutUrl(opts = {}) {
-      const doc = await discovery();
-      if (!doc.end_session_endpoint) {
-        throw new SsoError(
-          `${config.issuer} does not advertise end_session_endpoint \u2014 central logout is unavailable.`
-        );
-      }
-      const params = new URLSearchParams();
-      if (opts.idTokenHint) params.set("id_token_hint", opts.idTokenHint);
-      const post = opts.postLogoutRedirectUri ?? config.postLogoutRedirectUri;
-      if (post) params.set("post_logout_redirect_uri", post);
-      params.set("client_id", config.clientId);
-      return `${doc.end_session_endpoint}?${params}`;
-    },
-    async addressOwnership(accessToken, address) {
-      const body = await appPost(
-        "/api/app/address-ownership",
-        accessToken,
-        { address },
-        'address ownership (not "unverified")'
-      );
-      const status = body?.status;
-      if (typeof status !== "string" || !ADDRESS_OWNERSHIP.has(status)) {
-        throw new SsoError(`address-ownership returned status ${JSON.stringify(status)} \u2014 expected verified, unverified or not_on_account.`);
-      }
-      return status;
-    },
-    verifyLogoutToken,
-    async getProfile(accessToken) {
-      const path = "/api/app/profile";
-      return asProfile(await appRequest(path, accessToken, { method: "GET" }, "the profile"), path);
-    },
-    async updateProfile(accessToken, name) {
-      const path = "/api/app/profile";
-      return asProfile(await appRequest(path, accessToken, { method: "POST", json: { name } }, "the new name"), path);
-    },
-    async uploadAvatar(accessToken, bytes, contentType) {
-      const type = mediaType(contentType);
-      if (!AVATAR_TYPES.includes(type)) {
-        throw new SsoAvatarRejectedError(
-          `uploadAvatar: "${type}" is not accepted \u2014 BID takes ${AVATAR_TYPES.join(", ")}.`,
-          "unsupported_type"
-        );
-      }
-      if (bytes.byteLength > MAX_AVATAR_BYTES) {
-        throw new SsoAvatarRejectedError(
-          `uploadAvatar: ${bytes.byteLength} bytes \u2014 BID takes at most ${MAX_AVATAR_BYTES}.`,
-          "too_large"
-        );
-      }
-      const path = "/api/app/profile/avatar";
-      return asProfile(await appRequest(path, accessToken, { method: "POST", bytes, contentType: type }, "the new picture"), path);
-    },
-    async removeAvatar(accessToken) {
-      const path = "/api/app/profile/avatar/remove";
-      return asProfile(await appRequest(path, accessToken, { method: "POST" }, "the removed picture"), path);
-    },
-    async inviteUsers(appKey, input) {
-      if (input.users.length > MAX_INVITATIONS) {
-        throw new SsoError(`inviteUsers: ${input.users.length} users, BID accepts at most ${MAX_INVITATIONS} per call.`);
-      }
-      const body = await appPost("/api/app/invitations", appKey, input, "the invitation outcome");
-      if (!Array.isArray(body?.results)) {
-        throw new SsoError(`invitations returned no "results" array \u2014 the invitation outcome is unknown.`);
-      }
-      for (const r of body.results) {
-        if (typeof r?.outcome !== "string" || !INVITATION_OUTCOMES.has(r.outcome)) {
-          throw new SsoError(`invitations returned outcome ${JSON.stringify(r?.outcome)} for ${String(r?.email)} \u2014 not one this client knows.`);
-        }
-      }
-      return body.results;
-    },
-    async migrationStatus(appKey, emails) {
-      const body = await appPost("/api/app/migration-status", appKey, { emails }, "the migration state");
-      if (!Array.isArray(body?.users) || typeof body.complete !== "boolean") {
-        throw new SsoError(`migration-status returned no "users" array or no "complete" flag \u2014 the migration state is unknown.`);
-      }
-      for (const u of body.users) {
-        if (typeof u?.state !== "string" || !MIGRATION_STATES.has(u.state)) {
-          throw new SsoError(`migration-status returned state ${JSON.stringify(u?.state)} for ${String(u?.email)} \u2014 never read as "ready".`);
-        }
-      }
-      return body;
-    }
-  };
-}
-
-// src/tokens.ts
-function expiresAtFrom(expiresIn, accessToken, now) {
-  if (typeof expiresIn === "number" && expiresIn > 0) return now + Math.floor(expiresIn);
-  const parts = accessToken.split(".");
-  if (parts.length === 3) {
-    try {
-      const json = JSON.parse(atob(parts[1].replace(/-/g, "+").replace(/_/g, "/")));
-      if (typeof json.exp === "number" && json.exp > now) return json.exp;
-    } catch {
-    }
-  }
-  return now + 300;
-}
-function newSid() {
-  const b = crypto.getRandomValues(new Uint8Array(16));
-  let s = "";
-  for (const x of b) s += String.fromCharCode(x);
-  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-}
-
-// src/session.ts
-var enc = new TextEncoder();
-var b64url2 = (bytes) => {
-  let s = "";
-  for (const b of bytes) s += String.fromCharCode(b);
-  return btoa(s).replace(/\+/g, "-").replace(/\//g, "_").replace(/=+$/, "");
-};
-var fromB64url = (s) => {
-  const pad = s.replace(/-/g, "+").replace(/_/g, "/");
-  const bin = atob(pad + "=".repeat((4 - pad.length % 4) % 4));
-  return Uint8Array.from(bin, (c) => c.charCodeAt(0));
-};
-async function hmacKey(secret) {
-  return crypto.subtle.importKey("raw", enc.encode(secret), { name: "HMAC", hash: "SHA-256" }, false, [
-    "sign",
-    "verify"
-  ]);
-}
-async function signValue(value, secret, options = {}) {
-  const payload = b64url2(enc.encode(value));
-  const body = options.maxAgeSeconds === void 0 ? payload : `t${Math.floor((options.now ?? Date.now)() / 1e3)}~${payload}`;
-  const sig = new Uint8Array(await crypto.subtle.sign("HMAC", await hmacKey(secret), enc.encode(body)));
-  return `${body}.${b64url2(sig)}`;
-}
-var STAMPED = /^t(\d+)~(.*)$/s;
-async function verifyValue(token, secret, options = {}) {
-  if (!token) return null;
-  const dot = token.lastIndexOf(".");
-  if (dot <= 0) return null;
-  const body = token.slice(0, dot);
-  try {
-    const ok = await crypto.subtle.verify(
-      "HMAC",
-      await hmacKey(secret),
-      fromB64url(token.slice(dot + 1)),
-      enc.encode(body)
-    );
-    if (!ok) return null;
-    const stamped = STAMPED.exec(body);
-    if (options.maxAgeSeconds !== void 0) {
-      if (!stamped) return null;
-      const issuedAt = Number(stamped[1]);
-      if ((options.now ?? Date.now)() / 1e3 - issuedAt > options.maxAgeSeconds) return null;
-    }
-    return new TextDecoder().decode(fromB64url(stamped?.[2] ?? body));
-  } catch {
-    return null;
-  }
-}
-async function signSession(payload, secret) {
-  return signValue(JSON.stringify(payload), secret);
-}
-async function verifySession(token, secret, now = Date.now) {
-  const body = await verifyValue(token, secret);
-  if (body === null) return null;
-  try {
-    const payload = JSON.parse(body);
-    if (typeof payload.sub !== "string" || payload.sub === "") return null;
-    if (typeof payload.exp !== "number" || payload.exp * 1e3 <= now()) return null;
-    return payload;
-  } catch {
-    return null;
-  }
-}
-function cookieHeader(name, value, opts) {
-  const parts = [
-    `${name}=${value}`,
-    `Path=${opts.path ?? "/"}`,
-    `Max-Age=${opts.maxAge}`,
-    "HttpOnly",
-    // Lax, NOT Strict, and this is load-bearing: the callback from Broberg ID
-    // is a top-level GET navigation from another site. Strict withholds the
-    // cookie on exactly that navigation, so the login transaction cookie would
-    // be missing when it is needed and every sign-in would fail with "state
-    // does not match" — a message that sends you looking in the wrong place.
-    `SameSite=${opts.sameSite ?? "Lax"}`
-  ];
-  if (opts.secure) parts.push("Secure");
-  return parts.join("; ");
-}
-function readCookie(header, name) {
-  if (!header) return void 0;
-  for (const part of header.split(";")) {
-    const eq = part.indexOf("=");
-    if (eq === -1) continue;
-    if (part.slice(0, eq).trim() === name) return part.slice(eq + 1).trim();
-  }
-  return void 0;
-}
-
-// src/hono.ts
 var SESSION_KEY = "bidSession";
 var TRANSACTION_MAX_AGE = 300;
 var TRANSACTION_COOKIE_MAX_AGE = TRANSACTION_MAX_AGE * 3;
@@ -809,8 +31,8 @@ function safeReturnTo(raw, fallback) {
   return normalised;
 }
 function ssoRoutes(options = {}) {
-  const config = options.config ?? loadSsoConfig();
-  const client = options.client ?? createSsoClient(config);
+  const config = options.config ?? chunkJGIO7XPR_cjs.loadSsoConfig();
+  const client = options.client ?? chunkJGIO7XPR_cjs.createSsoClient(config);
   const loginPath = options.loginPath ?? "/auth";
   const defaultReturnTo = options.defaultReturnTo ?? "/";
   const txCookie = `${config.cookieName}_tx`;
@@ -824,7 +46,7 @@ function ssoRoutes(options = {}) {
   const callbackErrors = options.callbackErrors ?? "single";
   const onCallbackRefused = options.onCallbackRefused ?? ((cause) => console.warn(`[@broberg/sso] /callback refused: ${cause}`));
   async function liveSession(c) {
-    const session = await verifySession(readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
+    const session = await chunkJGIO7XPR_cjs.verifySession(chunkJGIO7XPR_cjs.readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
     if (!session || !backchannel) return session;
     try {
       const before = await backchannel.store.revokedBefore(session.sub);
@@ -850,7 +72,7 @@ function ssoRoutes(options = {}) {
       try {
         verified = await client.verifyLogoutToken(token);
       } catch (e) {
-        const msg = e instanceof SsoError ? e.message : "logout_token could not be verified";
+        const msg = e instanceof chunkJGIO7XPR_cjs.SsoError ? e.message : "logout_token could not be verified";
         return c.json({ error: "invalid_request", error_description: msg }, 400);
       }
       try {
@@ -879,7 +101,7 @@ function ssoRoutes(options = {}) {
       // The signed stamp carries the SERVER's window; the cookie carries the
       // longer browser one, so an expired transaction still reaches us and can
       // be named instead of vanishing.
-      cookieHeader(txCookie, await signValue(tx, config.cookieSecret, { maxAgeSeconds: TRANSACTION_MAX_AGE }), {
+      chunkJGIO7XPR_cjs.cookieHeader(txCookie, await chunkJGIO7XPR_cjs.signValue(tx, config.cookieSecret, { maxAgeSeconds: TRANSACTION_MAX_AGE }), {
         maxAge: TRANSACTION_COOKIE_MAX_AGE,
         secure: isSecure(c)
       })
@@ -888,7 +110,7 @@ function ssoRoutes(options = {}) {
   });
   app.get("/callback", async (c) => {
     const parsed = await parseTransaction(
-      readCookie(c.req.header("cookie"), txCookie),
+      chunkJGIO7XPR_cjs.readCookie(c.req.header("cookie"), txCookie),
       config.cookieSecret
     );
     if (!parsed.ok) {
@@ -920,7 +142,7 @@ function ssoRoutes(options = {}) {
         message: "This login could not be completed. Begin again from the login page."
       } : failures[parsed.reason];
       const { status, ...body } = shown;
-      c.header("Set-Cookie", cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }));
+      c.header("Set-Cookie", chunkJGIO7XPR_cjs.cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }));
       return c.json(body, status);
     }
     const result = await client.completeLogin({
@@ -933,12 +155,12 @@ function ssoRoutes(options = {}) {
     const exp = nowS + config.sessionMaxAge;
     let sid;
     if (tokenStore && result.accessToken) {
-      sid = newSid();
+      sid = chunkJGIO7XPR_cjs.newSid();
       await tokenStore.set(sid, {
         sub: result.claims.sub,
         accessToken: result.accessToken,
         ...result.refreshToken ? { refreshToken: result.refreshToken } : {},
-        expiresAt: expiresAtFrom(result.expiresIn, result.accessToken, nowS)
+        expiresAt: chunkJGIO7XPR_cjs.expiresAtFrom(result.expiresIn, result.accessToken, nowS)
       });
     }
     const session = {
@@ -954,14 +176,14 @@ function ssoRoutes(options = {}) {
     };
     c.header(
       "Set-Cookie",
-      cookieHeader(config.cookieName, await signSession(session, config.cookieSecret), {
+      chunkJGIO7XPR_cjs.cookieHeader(config.cookieName, await chunkJGIO7XPR_cjs.signSession(session, config.cookieSecret), {
         maxAge: config.sessionMaxAge,
         secure: isSecure(c)
       })
     );
     c.header(
       "Set-Cookie",
-      cookieHeader(idTokenCookie, await signValue(result.idToken, config.cookieSecret), {
+      chunkJGIO7XPR_cjs.cookieHeader(idTokenCookie, await chunkJGIO7XPR_cjs.signValue(result.idToken, config.cookieSecret), {
         maxAge: config.sessionMaxAge,
         secure: isSecure(c)
       }),
@@ -969,27 +191,27 @@ function ssoRoutes(options = {}) {
     );
     c.header(
       "Set-Cookie",
-      cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }),
+      chunkJGIO7XPR_cjs.cookieHeader(txCookie, "", { maxAge: 0, secure: isSecure(c) }),
       { append: true }
     );
     return c.redirect(parsed.tx.returnTo, 302);
   });
   app.get("/logout", async (c) => {
-    const idTokenHint = await verifyValue(
-      readCookie(c.req.header("cookie"), idTokenCookie),
+    const idTokenHint = await chunkJGIO7XPR_cjs.verifyValue(
+      chunkJGIO7XPR_cjs.readCookie(c.req.header("cookie"), idTokenCookie),
       config.cookieSecret
     );
     if (tokenStore) {
-      const leaving = await verifySession(readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
+      const leaving = await chunkJGIO7XPR_cjs.verifySession(chunkJGIO7XPR_cjs.readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
       if (leaving?.sid) await tokenStore.delete(leaving.sid);
     }
     c.header(
       "Set-Cookie",
-      cookieHeader(config.cookieName, "", { maxAge: 0, secure: isSecure(c) })
+      chunkJGIO7XPR_cjs.cookieHeader(config.cookieName, "", { maxAge: 0, secure: isSecure(c) })
     );
     c.header(
       "Set-Cookie",
-      cookieHeader(idTokenCookie, "", { maxAge: 0, secure: isSecure(c) }),
+      chunkJGIO7XPR_cjs.cookieHeader(idTokenCookie, "", { maxAge: 0, secure: isSecure(c) }),
       { append: true }
     );
     if ((options.logout ?? "app") === "app") {
@@ -1016,23 +238,23 @@ function ssoRoutes(options = {}) {
   const refreshing = /* @__PURE__ */ new Map();
   async function getAccessToken(c) {
     if (!tokenStore) {
-      throw new SsoError("getAccessToken needs ssoRoutes({ tokenStore }) \u2014 without one the login's tokens are not kept.");
+      throw new chunkJGIO7XPR_cjs.SsoError("getAccessToken needs ssoRoutes({ tokenStore }) \u2014 without one the login's tokens are not kept.");
     }
-    const raw = await verifySession(readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
+    const raw = await chunkJGIO7XPR_cjs.verifySession(chunkJGIO7XPR_cjs.readCookie(c.req.header("cookie"), config.cookieName), config.cookieSecret);
     const live = await liveSession(c);
     if (!live) {
       if (raw?.sid) await tokenStore.delete(raw.sid);
-      throw new SsoReauthError("no live session \u2014 log in again.", "no_session");
+      throw new chunkJGIO7XPR_cjs.SsoReauthError("no live session \u2014 log in again.", "no_session");
     }
     const sid = live.sid;
-    if (!sid) throw new SsoReauthError("this session has no stored tokens (it began before tokenStore was configured) \u2014 log in again.", "no_tokens");
+    if (!sid) throw new chunkJGIO7XPR_cjs.SsoReauthError("this session has no stored tokens (it began before tokenStore was configured) \u2014 log in again.", "no_tokens");
     const tokens = await tokenStore.get(sid);
-    if (!tokens) throw new SsoReauthError("no tokens stored for this session \u2014 log in again.", "no_tokens");
+    if (!tokens) throw new chunkJGIO7XPR_cjs.SsoReauthError("no tokens stored for this session \u2014 log in again.", "no_tokens");
     const now = Math.floor(Date.now() / 1e3);
     if (tokens.expiresAt - 30 > now) return tokens.accessToken;
     if (!tokens.refreshToken) {
       await tokenStore.delete(sid);
-      throw new SsoReauthError("the access token has expired and there is no refresh token \u2014 log in again.", "expired");
+      throw new chunkJGIO7XPR_cjs.SsoReauthError("the access token has expired and there is no refresh token \u2014 log in again.", "expired");
     }
     const inFlight = refreshing.get(sid);
     if (inFlight) return inFlight;
@@ -1042,14 +264,14 @@ function ssoRoutes(options = {}) {
         next = await client.refreshTokens(tokens.refreshToken);
       } catch (e) {
         await tokenStore.delete(sid);
-        throw new SsoReauthError(e instanceof SsoError ? e.message : "token refresh failed", "refresh_failed");
+        throw new chunkJGIO7XPR_cjs.SsoReauthError(e instanceof chunkJGIO7XPR_cjs.SsoError ? e.message : "token refresh failed", "refresh_failed");
       }
       await tokenStore.set(sid, {
         sub: tokens.sub,
         accessToken: next.accessToken,
         // Rotation: use the new one if BID issued one, else keep the old.
         ...next.refreshToken ?? tokens.refreshToken ? { refreshToken: next.refreshToken ?? tokens.refreshToken } : {},
-        expiresAt: expiresAtFrom(next.expiresIn, next.accessToken, Math.floor(Date.now() / 1e3))
+        expiresAt: chunkJGIO7XPR_cjs.expiresAtFrom(next.expiresIn, next.accessToken, Math.floor(Date.now() / 1e3))
       });
       return next.accessToken;
     })();
@@ -1073,7 +295,7 @@ function ssoRoutes(options = {}) {
     if (left <= 0) return;
     c.header(
       "Set-Cookie",
-      cookieHeader(config.cookieName, await signSession(next, config.cookieSecret), { maxAge: left, secure: isSecure(c) }),
+      chunkJGIO7XPR_cjs.cookieHeader(config.cookieName, await chunkJGIO7XPR_cjs.signSession(next, config.cookieSecret), { maxAge: left, secure: isSecure(c) }),
       { append: true }
     );
   }
@@ -1081,9 +303,9 @@ function ssoRoutes(options = {}) {
 }
 async function parseTransaction(raw, secret) {
   if (raw === void 0) return { ok: false, reason: "absent" };
-  const signed = await verifyValue(raw, secret);
+  const signed = await chunkJGIO7XPR_cjs.verifyValue(raw, secret);
   if (signed === null) return { ok: false, reason: "unreadable" };
-  const fresh = await verifyValue(raw, secret, { maxAgeSeconds: TRANSACTION_MAX_AGE });
+  const fresh = await chunkJGIO7XPR_cjs.verifyValue(raw, secret, { maxAgeSeconds: TRANSACTION_MAX_AGE });
   if (fresh === null) return { ok: false, reason: "expired" };
   try {
     const tx = JSON.parse(fresh);
@@ -1153,16 +375,16 @@ function accountRoutes(sso) {
   });
   app.post("/profile/avatar", async (c) => {
     const token = await sso.getAccessToken(c);
-    const type = mediaType(c.req.header("content-type"));
-    if (!AVATAR_TYPES.includes(type)) {
-      return c.json({ error: "unsupported_type", accepted: AVATAR_TYPES }, 415);
+    const type = chunkJGIO7XPR_cjs.mediaType(c.req.header("content-type"));
+    if (!chunkJGIO7XPR_cjs.AVATAR_TYPES.includes(type)) {
+      return c.json({ error: "unsupported_type", accepted: chunkJGIO7XPR_cjs.AVATAR_TYPES }, 415);
     }
     const declared = Number(c.req.header("content-length"));
-    if (Number.isFinite(declared) && declared > MAX_AVATAR_BYTES) {
-      return c.json({ error: "too_large", max_bytes: MAX_AVATAR_BYTES }, 413);
+    if (Number.isFinite(declared) && declared > chunkJGIO7XPR_cjs.MAX_AVATAR_BYTES) {
+      return c.json({ error: "too_large", max_bytes: chunkJGIO7XPR_cjs.MAX_AVATAR_BYTES }, 413);
     }
-    const bytes = await readCapped(c, MAX_AVATAR_BYTES);
-    if (!bytes) return c.json({ error: "too_large", max_bytes: MAX_AVATAR_BYTES }, 413);
+    const bytes = await readCapped(c, chunkJGIO7XPR_cjs.MAX_AVATAR_BYTES);
+    if (!bytes) return c.json({ error: "too_large", max_bytes: chunkJGIO7XPR_cjs.MAX_AVATAR_BYTES }, 413);
     return answer(c, await client.uploadAvatar(token, bytes, type));
   });
   app.post("/profile/avatar/remove", async (c) => answer(c, await client.removeAvatar(await sso.getAccessToken(c))));
@@ -1175,7 +397,7 @@ function accountRoutes(sso) {
       case "SsoInsufficientScopeError":
         return c.json({ error: "insufficient_scope", scope: e.scope }, 403);
       case "SsoAvatarRejectedError":
-        return e.reason === "too_large" ? c.json({ error: "too_large", max_bytes: MAX_AVATAR_BYTES }, 413) : c.json({ error: "unsupported_type", accepted: AVATAR_TYPES }, 415);
+        return e.reason === "too_large" ? c.json({ error: "too_large", max_bytes: chunkJGIO7XPR_cjs.MAX_AVATAR_BYTES }, 413) : c.json({ error: "unsupported_type", accepted: chunkJGIO7XPR_cjs.AVATAR_TYPES }, 415);
       case "SsoAppApiError": {
         if (e.status === 401) return c.json({ error: "reauth" }, 401);
         if (typeof e.status === "number" && e.status >= 400 && e.status < 500) {